From 556cef27d905d31f8299e124bbcb9f2931830eae Mon Sep 17 00:00:00 2001 From: Manuel Lauss Date: Mon, 22 Sep 2025 09:56:00 +0200 Subject: [PATCH] avcodec/sanm: enforce SANM min and max sizes at decode_init() Enforce at least 8x8 and at max 800x600 for SANM/BL16. Signed-off-by: Manuel Lauss --- libavcodec/sanm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index 7a4a9b2a03..3981df8f0c 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -639,6 +639,10 @@ static av_cold int decode_init(AVCodecContext *avctx) // ANIM has no dimensions in the header, distrust the incoming data. avctx->width = avctx->height = 0; ctx->have_dimensions = 0; + } else if (avctx->width > 800 || avctx->height > 600 || + avctx->width < 8 || avctx->height < 8) { + // BL16 valid range is 8x8 - 800x600 + return AVERROR_INVALIDDATA; } init_sizes(ctx, avctx->width, avctx->height); if (init_buffers(ctx)) {